Preparing for your ISO 22301 certification audit: a practical guide

Your audit date is on the calendar, the plans look decent, yet there’s that nagging question: will the auditor see a system that works, or a folder of documents? If you’re aiming for ISO 22301 certification, here’s how to prepare so the story your BCMS tells is clear, credible and complete.

I’ve pulled these tips from real audits—manufacturers with single sites, multi-office professional services, and cloud providers with complex third parties. The details vary, but the fundamentals don’t.

Know what the auditor will actually do

Most ISO 22301 assessments follow two stages. Understanding the purpose of each is half the battle.

• Stage 1 reviews readiness: scope, documented information, key processes, and whether you’re set for Stage 2.
• Stage 2 samples implementation: interviews, records, exercises, recovery arrangements and how improvement works day to day.

Expect interviews across functions—operations, IT, HR, facilities, procurement—and at least one walk-through of an exercise and a real incident or disruption you’ve handled, even if minor.

Get the basics tight: scope, context and governance

If the foundations wobble, everything on top will too. Before anything else, make sure these elements are crisp, current and consistent:

• Scope that names locations, services, products and exclusions in plain language.
• Context and interested parties’ needs (customers, regulators, insurers, critical suppliers) with a short rationale for each.
• Legal and contractual requirements mapped to your controls and plans.
• Roles and responsibilities for continuity, including deputies and on-call arrangements.
• Policy and objectives that align with business priorities and are measurable.

Auditors will check that what’s written matches what people say. If your scope says three sites but your risk register covers two, expect questions.

Show the continuity lifecycle working

ISO 22301 is about a living system, not a template. Build your preparation around the lifecycle—analysis, strategy, planning, exercising, reviewing and improving.

Business impact analysis and risk assessment

• Keep a BIA that identifies time-critical activities and sets realistic RTOs and RPOs.
• Link dependencies clearly—people, facilities, IT systems, data, suppliers and manual workarounds.
• Document risk criteria you actually use and show how risks drive your strategies.
• Demonstrate periodic review and updates after change, not just annually.

A good BIA reads like your business—service lines, peaks and troughs, third parties named where they matter. If it looks generic, it probably is.

Strategies and plans that you’ve proved

• Show documented continuity strategies (e.g. alternate site, remote working, secondary telecoms, data replication) that support the RTOs.
• Provide role-based plans and playbooks with clear triggers, actions and communications.
• Evidence capacity checks—licences, laptops, VPN, call-tree volumes and supplier SLAs tested.
• Demonstrate alignment with IT disaster recovery and information security if you run both.

A common pitfall is a plan that lists actions without proving the resources exist. If your plan assumes 100 laptops for remote work, be ready to show the inventory or rental agreement.

Exercises, incidents and improvement

• Run exercises that reflect your risk—tabletop is fine, but occasional technical or end-to-end drills add weight.
• Keep exercise reports with objectives, scenario, outcomes, timings, gaps and actions.
• Log real incidents (even small outages), decisions made and lessons learned.
• Track corrective actions to closure with owners and due dates.

A single tabletop a year may meet a minimum, but it won’t impress if your environment is complex. One client combined a cybersecurity tabletop with a partial restore test; the linkage sold the story.

Evidence that helps — and the things that raise eyebrows

During Stage 2, auditors sample records to corroborate what they hear. Gather and sanity-check these in advance:

• Up-to-date contact lists with last review dates and a quick test log.
• Supplier SLAs, dependency maps and any proof of supplier exercise participation.
• System recovery evidence—backup reports, restore tests, failover screenshots with dates.
• Training and awareness records for responders and alternates.
• Change records showing plans were reviewed when systems or structures changed.
• Management review minutes covering ISO 22301 inputs and resulting actions.
• Internal audit reports with scope, findings and follow-up.

Red flags we see often:

• Plans reference outdated systems or people no longer in role.
• RTOs don’t match the recovery capabilities you’ve demonstrated.
• Exercises with no defined objectives or actions that quietly disappear.
• Internal audit limited to document checking with no process sampling.
• Management review that skips performance, trends and resource decisions.

Prepare your people and the audit logistics

Audits go smoothly when the right people say the right things with the right evidence at hand. A bit of choreography helps.

1. Nominate process owners for BIA, plans, exercises, ITDR, suppliers and communications.
2. Build an interview schedule that follows the lifecycle and avoids double-booking.
3. Set up controlled access to documents, records and systems the auditor may sample.
4. Walk through one recent exercise end-to-end, so all contributors know the story.
5. Coach teams to answer plainly, show what they do and admit gaps with actions.
6. Keep a running log of requests during the audit to avoid missed items.

Resist the urge to over-script. Auditors can tell when only the consultant speaks; we’ll ask to hear from the people who run the process on Tuesday afternoon, not just in a test.

Common nonconformities and how to avoid them

• Scope omits a function or site that the BIA clearly depends on.
• Risk criteria are undefined or not applied consistently in assessments.
• Recovery strategies are untested, unfunded or rest on a single person.
• Contact lists and call-trees lack evidence of periodic verification.
• Internal audits don’t cover implementation or lack competent auditors.
• Management reviews miss mandatory inputs or actions are not tracked.
• Plans not updated after change—M&A, new systems, office moves or supplier shifts.

Prevent most of these by tying actions to change management, maintaining a simple audit programme that samples real processes, and treating management review as a decision meeting, not a slide deck.

If you also run ISO 27001 or others

Many organisations integrate business continuity with information security and quality. That’s sensible, but clarity matters. Keep risk methodologies compatible, align objectives and reviews, and avoid duplicated documents with different truths. For example, if asset registers and recovery tiers live in IT service management, reference them rather than copying.

Use Stage 1 well, then close gaps fast

Stage 1 findings are your early warning. Prioritise fixes that affect implementation—untested strategies, unclear roles, missing monitoring—before polishing templates. Document what you change and why. If timelines are tight, agree a realistic plan and show progress, not promises.

Above all, keep perspective. ISO 22301 doesn’t demand perfection; it asks for a system that matches your risk, works when needed and keeps improving. If that’s what the auditor sees, the certificate tends to follow.

If you’d like a plain-English conversation about where you are and what an audit will focus on, get in touch with UKCTL. We’re happy to talk through practical next steps and what good evidence looks like for your organisation.